As used in this part 3, unless the context otherwise requires:
(1) Accountability report means a report developed pursuant to section 24-18-302 (2).
(2) Agency means:
(a) An agency of the state government or of a local government; or
(b) A state institution of higher education.
(3) Decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals means decisions that:
(a) Result in the provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health-care services, or access to basic necessities such as food and water; or
(b) Impact the civil rights of individuals.
(4) Enroll, enrolled, or enrolling means:
(a) The process by which a facial recognition service:
(I) Creates a facial template from one or more images of an individual; and
(II) Adds the facial template to a gallery that is used by the facial recognition service for recognition or persistent tracking of individuals; or
(b) The act of adding an existing facial template directly into a gallery that is used by a facial recognition service.
(5) (a) Facial recognition service means technology that analyzes facial features to facilitate the identification, verification, or persistent tracking of individuals in still or video images.
(b) Facial recognition service does not include:
(I) The analysis of facial features to grant or deny access to an electronic device;
(II) A generally available consumer product, including a tablet or smartphone, that allows for the analysis of facial features in order to facilitate the user's ability to manage an address book or still or video images for personal or household use; or
(III) The use of an automated or semiautomated process by a law enforcement agency for the purpose of redacting a recording for release or disclosure to protect the privacy of a subject depicted in the recording, so long as the process does not generate or result in the retention of any biometric data or surveillance information.
(6) Facial template means a machine-interpretable pattern of facial features that is extracted from one or more images of an individual by a facial recognition service.
(7) Identification means the use of a facial recognition service by an agency to determine whether an unknown individual matches any individual whose identity is known to the agency and who has been enrolled by reference to that identity in a gallery used by the facial recognition service.
(8) Local government means a statutory or home rule municipality, a county, or a city and county.
(9) Meaningful human review means review or oversight by one or more individuals who are trained in accordance with section 24-18-305 and who have the authority to alter a decision under review.
(10) Nonidentifying demographic data means data that is not linked or reasonably linkable to an identified or identifiable individual and includes information about an individual's gender, race, ethnicity, age, or location.
(11) (a) Ongoing surveillance means the continual use of a facial recognition service by an agency to track in real time the physical movements of a specified individual through one or more public places.
(b) Ongoing surveillance does not include a single recognition or attempted recognition of an individual if no attempt is made to subsequently track that individual's movement over time after the individual has been recognized.
(12) Persistent tracking means the use of a facial recognition service by an agency to track the movements of an individual on a persistent basis without identification or verification of the individual. Tracking becomes persistent as soon as:
(a) The facial template that permits the tracking is maintained for more than forty-eight hours after first enrolling that template; or
(b) Data created by the facial recognition service is linked to any other data such that the individual who has been tracked is identified or identifiable.
(13) Recognition means the use of a facial recognition service by an agency to determine whether an unknown individual matches:
(a) Any individual who has been enrolled in a gallery used by the facial recognition service; or
(b) A specific individual who has been enrolled in a gallery used by the facial recognition service.
(14) Reporting authority means:
(a) For a local government agency, the city council, county commission, or other local government agency in which legislative powers are vested; and
(b) For a state agency, the office of information technology created in section 24-37.5-103.
(15) Verification means the use of a facial recognition service by an agency to determine whether an individual is a specific individual whose identity is known to the agency and who has been enrolled by reference to that identity in a gallery used by the facial recognition service.
Source: L. 2022: Entire part added, (SB 22-113), ch. 463, p. 3284, � 4, effective August 10.
24-18-302. Notice of intent to use facial recognition service - accountability reports - public review and comment - notice - exemption. (1) On and after August 10, 2022, an agency that uses or intends to develop, procure, or use a facial recognition service shall file with its reporting authority a notice of intent to develop, procure, use, or continue to use the facial recognition service and specify a purpose for which the technology is to be used.
(2) Except as described in subsection (8) of this section, after filing the notice of intent described in subsection (1) of this section, and prior to developing, procuring, using, or continuing to use a facial recognition service, an agency shall produce an accountability report for the facial recognition service. An accountability report must include:
(a) (I) The name, vendor, and version of the facial recognition service; and
(II) A description of its general capabilities and limitations, including reasonably foreseeable capabilities outside the scope of the agency's proposed use;
(b) (I) The type of data inputs that the facial recognition service uses;
(II) How data is generated, collected, and processed; and
(III) The type of data the facial recognition service is reasonably likely to generate;
(c) A description of the purpose and proposed use of the facial recognition service, including:
(I) What decision will be used to make or support the facial recognition service; and
(II) The intended benefits of the proposed use, including any data or research demonstrating those benefits;
(d) A clear use and data management policy, including protocols for the following:
(I) How, when, and by whom the facial recognition service will be deployed or used; to whom data will be available; the factors that will be used to determine where, when, and how the technology is deployed; and other relevant information, such as whether the technology will be operated continuously or used only under specific circumstances;
(II) If the facial recognition service will be operated or used by an entity on the agency's behalf, a description of the entity's access and any applicable protocols;
(III) Any measures taken to minimize inadvertent collection of additional data beyond the amount necessary for the specific purpose for which the facial recognition service will be used;
(IV) Data integrity and retention policies applicable to the data collected using the facial recognition service, including how the agency will maintain and update records used in connection with the service, how long the agency will keep the data, and the processes by which data will be deleted;
(V) What processes will be required prior to each use of the facial recognition service;
(VI) Data security measures applicable to the facial recognition service, including:
(A) How data collected using the facial recognition service will be securely stored and accessed; and
(B) If an agency intends to share access to the facial recognition service or the data from that facial recognition service with any third party that is not a law enforcement agency, the rules and procedures by which the agency will ensure that the third party complies with the agency's use and data management policy;
(VII) The agency's training procedures, including those implemented in accordance with section 24-18-305, and how the agency will ensure that all personnel who operate the facial recognition service or access its data are knowledgeable about and able to ensure compliance with the use and data management policy before using the facial recognition service; and
(VIII) Any other policies that will govern use of the facial recognition service;
(e) The agency's testing procedures, including its processes for periodically undertaking operational tests of the facial recognition service in accordance with section 24-18-304;
(f) Information concerning the facial recognition service's rate of false matches, potential impacts on protected subpopulations, and how the agency will address error rates that are determined independently to be greater than one percent;
(g) A description of any potential impacts of the facial recognition service on civil rights and liberties, including potential impacts to privacy and potential disparate impacts on marginalized communities, including the specific steps the agency will take to mitigate the potential impacts; and
(h) The agency's procedures for receiving feedback, including the channels for receiving feedback, from individuals affected by the use of the facial recognition service and from the community at large, as well as the procedures for responding to feedback.
(3) Prior to finalizing an accountability report, an agency shall:
(a) Allow for a public review and comment period;
(b) Hold at least three public meetings to obtain feedback from communities; and
(c) Consider the issues raised by the public through the public meetings.
(4) At least ninety days before an agency puts a facial recognition service into operational use, the agency shall post the final adopted accountability report on the agency's public website and submit it to the agency's reporting authority. The reporting authority shall post the most recent version of each submitted accountability report on its public website.
(5) An agency shall update its final accountability report and submit the updated accountability report to the agency's reporting authority at least every two years.
(6) An agency seeking to procure a facial recognition service must require each vendor to disclose any complaints or reports of bias regarding the vendor's facial recognition service.
(7) An agency seeking to use a facial recognition service for a purpose not disclosed in the agency's existing accountability report must:
(a) Seek and consider public comments and community input concerning the proposed new use; and
(b) In response to such comments and input, adopt an updated accountability report as described in this section.
(8) The requirements of subsections (2), (3), (4), (5), and (7) of this section concerning accountability reports do not apply to an agency's procurement or use of a facial recognition service if:
(a) The facial recognition service is part of a generally available consumer product;
(b) The facial recognition service is included in the consumer product only for personal or household use; and
(c) The agency certifies publicly that the facial recognition service is not the reason for the agency's procurement or use of the consumer product and will not be used for governmental purposes.
Source: L. 2022: Entire part added, (SB 22-113), ch. 463, p. 3286, � 4, effective August 10.
24-18-303. Use of facial recognition service - meaningful human review of certain decisions required. An agency using a facial recognition service to make decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals must ensure that those decisions are subject to meaningful human review.
Source: L. 2022: Entire part added, (SB 22-113), ch. 463, p. 3289, � 4, effective August 10.
24-18-304. Use of facial recognition service - testing required before use in certain contexts - testing capability required - exemption. (1) Except as described in subsection (4) of this section, before deploying a facial recognition service in a context in which it will be used to make decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals, an agency must test the facial recognition service in operational conditions. An agency must take reasonable steps to ensure best quality results by following all guidance provided by the developer of the facial recognition service.
(2) (a) Except as described in subsection (4) of this section, an agency that deploys a facial recognition service shall require the facial recognition service provider to make available an application programming interface or other technical capability, chosen by the provider, to enable legitimate, independent, and reasonable tests of the facial recognition service for accuracy and to identify unfair performance differences across distinct subpopulations, including subpopulations that are defined by visually detectable characteristics such as:
(I) Race, skin tone, ethnicity, gender, age, or disability status; or
(II) Other protected characteristics that are objectively determinable or self-identified by the individuals portrayed in the testing dataset.
(b) If the results of independent testing identify material unfair performance differences across subpopulations, the provider must develop and implement a plan to mitigate the identified performance differences within ninety days after receipt of the results.
(c) Subsection (2)(a) of this section does not require a provider to disclose proprietary material or make available an application programming interface or other technical capability in a manner that would increase the risk of cyber attacks. Providers bear the burden of minimizing these risks when making an application programming interface or other technical capability available for testing purposes.
(3) Nothing in this section requires an agency to collect or provide data to a facial recognition service provider to satisfy the requirements in subsection (1) of this section.
(4) The requirements of subsections (1) and (2) of this section do not apply if the facial recognition service provider is a participant in the face recognition vendor test ongoing project of the national institute of standards and technology.
Source: L. 2022: Entire part added, (SB 22-113), ch. 463, p. 3289, � 4, effective August 10.